Malicious network traffic can take many different forms. For example, some traffic may seek to overwhelm a service by sending a large number of requests to the service. Such attacks are also sometimes known as denial of service (DoS) attacks. Other forms of malicious traffic may seek to exfiltrate sensitive information from a network, such as credit card numbers, trade secrets, and the like. Typically, such traffic is generated by a client that has been infected with malware. Thus, a further type of malicious network traffic includes network traffic that propagates the malware itself.
Intrusion Prevention Systems (IPS), firewalls, and flow monitoring systems generally attempt to detect and block malicious traffic, whenever possible. However, in recent years, the amount of encrypted network traffic has increased considerably. Notably, with the advent of transport layer security (TLS) and other security mechanisms, many websites are now encrypting even traditional webpage data. This presents certain challenges to security systems as the cleartext contents of the traffic may not be available for analysis and pattern matching is generally inapplicable to encrypted traffic.